Beyond the Buzzword: DevSecOps Is Here to Stay

DevOps  has paid off for many organizations. The DevOps movement is focused on delivering high-quality software as quickly as possible by helping organizations become more agile. They can reduce time to market and gain a competitive edge as they can release new features faster.

Moreover, DevOps consists of a five-step process: analysis and planning, development, testing, deployment, and monitoring. However, there’s a problem with this: the DevOps movement doesn’t have a strong focus on the security aspects of software development.

For that reason, the buzzword DevSecOps has been coined to integrate security as an integral part of the movement. This article looks beyond the hype and answers the following questions:

• What is the importance of security in DevOps?
• What is DevSecOps?
• How do you shift toward DevSecOps?

What Is the Importance of Security in DevOps?

You can have a very optimized release process and still release code that has security flaws. Therefore, it’s easier and cheaper to resolve security issues directly during the development of a new feature instead of fixing it a few months later. By then, the issue might have become a real problem that requires you to make bigger changes. In short, integrating security into the DevOps life cycle can save you a lot of time and resources.

Moreover, security is an essential part of quality, so if you want to deliver quality products, you should develop with security in mind.

So, what is DevSecOps exactly?

An Introduction to DevSecOps

DevSecOps looks to combine both SecOps and DevOps operations. The goal of DevSecOps is to improve code quality and reduce time to market while also ensuring that the code complies with best security practices.

Furthermore, DevSecOps focuses on implementing automated security testing such as automated code analysis, threat detection, and compliance monitoring. By implementing automated security testing, an organization can produce even higher quality software with security in mind. It also enables the company to have a higher level of confidence in the products it develops.

Tips for Shifting Toward DevSecOps

Let’s review three important tips to implement DevSecOps.

1. Add Automated Security Testing

The simplest tip is to add automated security testing to your continuous integration (CI) pipeline. Here are a couple of commonly used tools for security testing:

• Code linting helps you develop consistent code and find syntax errors before execution.
• Static analysis with tools such as SonarQube or DeepScan uses machine learning to detect mistakes.
• Automated penetration testing tools and API endpoint vulnerability verifiers help you find incorrectly configured web servers or vulnerable API endpoints that hackers can exploit.

2. Focus on Secret Management

You’ll also need to develop a policy on how to handle and generate secrets. You should have a policy against sharing secrets via email or other insecure means.

You should also set standards for how to handle secrets, such as never storing secrets as plain text in your code. If you do, an attacker would be able to read those secrets and take advantage of them. Therefore, you’ll need to define some guidance about this. For example, in Node.js, secrets are handled via a .env file, which allows you to safely pass secrets to your application without revealing them.

3. Manage Access Rights

>Many organizations give all their developers admin control over the tools they use. As you can see, this is not a good strategy. Try to give the fewest number of privileges to your developers that they need to execute their tasks. Admin controls should only be reserved to persons such as the CTO or the project manager. There’s no need to give every developer admin controls as there’s always a small chance someone will abuse this power.

Conclusion

During recent years, DevOps has focused on improving the efficiency of the development life cycle. And it has succeeded in this mission for speed and efficiency. However, while focusing on speed, developers neglected security. DevSecOps is here to fix this trend and introduce organizations to automated security testing. Many products exist already that only minimally impact the overall efficiency of your CI processes.

Michiel Mulders